Attackers exploit 'SSHole' authentication bypass in OpenSSH
SecurityWeek reports that exploitation attempts against an OpenSSH authentication bypass dubbed 'SSHole' have begun. The initial attempts are attributed to botnets and crypto miners, and other threat actors are expected to follow.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- OpenSSH
- Product
- OpenSSH
- Status
- Confirmed
- First seen
- Confirmed
What to do
Update OpenSSH to a patched release as soon as one is available from your distribution or vendor
Restrict SSH access to trusted networks or VPNs until patched
Review authentication logs for unexpected successful logins
Identify OpenSSH versions in use and apply the vendor patch as soon as it is available
Rotate credentials on any host that may have been exposed
Timeline
- Made public by Mastodon1 day
- First seen by cve.now2 days
- Record last updated
- Confirmed as CVE-2026-123158
On X 10
Bala 🧤@BalaiBBevery piece of software you trust right now has a vulnerability that nobody's found yet not some of them. all of them your wallet, your browser, your banking app, your password manager, the operating system running your phone right now openssh runs almost every server on earth, somebody found out that typing 257 random characters as the password gives you full root access. just like that microsoft paint, the app you drew stick figures on as a kid, just got a vulnerability that lets attackers run code on your computer through the internet. paint. apple told everyone icloud was end-to-end encrypted, then buried in a support page that sharing a link kills the encryption completely even if you paid for advanced data protection these are the most audited, funded, and trusted tools ever built and they keep falling apart in ways nobody predicted code is written by humans who cut corners, increasingly generated by AI that doesn't understand what it's producing, and tested by systems that can only catch what someone thought to look for "secure software" doesn't exist. there's just software running on borrowed time until someone finds the crack
CyberSatoshi 𓆙@XBToshi"ed25519 is broken, AI models made Monero transparent, so I sold my bags." That's a common misunderstanding of what current situation is: 1. If curve25519 math breaks, crypto is footnote news. - Openssh is bricked. - GitHub/GitLab commit signatures collapse. - Wireguard VPNs turn into clear text. - WhatsApp/Signal double-ratchet E2EE decrypts retrospectively. - Apple secure enclave authentication is compromised. The entire modern internet infrastructure collapses before your exchange order even fills. 2. An LLM cannot magically solve discrete logs or invert Pedersen commitments. AI models only run heuristic clustering on bad decoy selection and network-level metadata. That's why Monero is migrating to FCMP++ (full-chain membership proofs) -- scaling the anonymity set from 16 decoys to literally the entire blockchain ledger. We should be far more concerned about the accelerating trend toward mass surveillance and expanding regulatory control than about a mathematical breakthrough in curve theory.
Josh Builds@Joshua_WDFor 10 years, OpenSSH on Alpine let a 257+ character password into accounts that were never supposed to take one. A researcher found it with agents and 12 sshd builds. Who's exposed, how to check, and the testing trick I'd copy. x.com/i/article/2118…
Show 7 more posts
SecPoint@secpointOpenSSH Password Authentication Bypass on Alpine Linux CVE-2026-123158 was publicly disclosed on 5 November 2026. An attacker reaching SSH on certain musl-based Linux systems, including Alpine Linux, may log in to accounts that should not accept passwords. Exploitation requires OpenSSH without PAM, SSH password authentication enabled, a passwordless account and another account with a stored password hash. Ordinary glibc-based Linux installations are not affected by this issue. Update to the applicable fixed OpenSSH or Alpine package, then restart sshd. If patching is delayed, disable SSH password authentication after confirming key-based access works. SecPoint Penetrator helps organizations assess network exposure. Get a FREE vulnerability scan: secpoint.com/free-vulnerabi… Become a SecPoint partner: secpoint.com/partner-signup… #SecPoint #OpenSSH #AlpineLinux #AuthenticationBypass #CyberSecurity
Venkata Satish Guttula 🛰️@snakeyesV1💻 Tech: • An OpenSSH flaw on Alpine Linux was exploited within hours of disclosure; fix is in 10.6p2. • Microsoft is winding down a deal to rent AI cloud capacity from Oracle, Reuters reports. • Walmart will take drone delivery to 300 more stores as Zipline raises $1.5B.
たーちゃん@フリーランスエンジニア@obataka123Nov 7 IT Trends What engineers must know 🧵 ・OpenSSH sshole — exploited in 9h ・Inkling 2 Small — 594B MoE ・Node.js 26 — now LTS Read more 👇 obataka.com/2026%e5%b9%b41… 💡 musl & PAM explained — on note note.com/obataka123/n/n…
Cyber Tzar@cybertzarAn OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. #cybersecurity helpnetsecurity.com/2026/11/06/ope…
Cyphere@TheCyphereOpenSSH flaw lets attackers log into password-disabled Linux accounts A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by e
Reynaldo - 🇧🇷@uniqsuporteiaA PoC/exploit has been discovered for vulnerability CVE-2026-123158 PT ID: PT-2026-137533 Read on dbugs: dbu.gs/vulnerability/… Vendor: OpenSSH Product: OpenSSH Portable (musl Linux) Description: An authentication bypass vulnerability in OpenSSH before 10.6p2 allows unauthenticated remote attackers to log in to password-locked accounts on Linux systems using musl libc without PAM. Due to improper handling of oversized passwords, musl's crypt() function returns "*", which can match the stored password value of a locked account. Under affected configurations, an arbitrary password between 257 and 1024 characters can grant unauthorized SSH access with the privileges of the targeted account. Link: github.com/oz9un/sshole
Cryptoding@cryptodingSecurity Alert CZ warns about a decade-old OpenSSH vulnerability in Alpine Linux and urges users to install the latest security patch to protect their servers. #CyberSecurity #OpenSSH #CryptoSecurity
Evidence 9
- SocialMastodon
“Within nine hours of being made public, the SSHole flaw (CVE-2026-123158) was exploited by hackers, highlighting the alarming speed at which cyber threats can spread.”
- SocialMastodon
“Patch OpenSSH immediately — there is no negotiating with CVE-2026-123158.”
- Socialoss-security
“Re: "sshole": password authentication bypass: OpenSSH + musl libc”
+1 more: oss-security - SocialMastodon
“OpenSSH vulnerability CVE-2026-123158 (SSHole) is under active exploitation within hours of disclosure.”
- SocialMastodon
“An attacker reaching SSH on certain musl-based Linux systems, including Alpine Linux, may log in to accounts that should not accept passwords.”
Show all 9 sourcesShow fewer sources
- Socialr/cybersecurity
“Under specific conditions, an attacker with network access to the SSH service can authenticate to an account that has no password configured by sending an unusually long password.”
- SocialMastodon
“The OpenSSH SSHole vulnerability is being actively exploited against Alpine Linux honeypots, prompting urgent upgrades to OpenSSH 10.6p2.”
- PressSecurityWeek
“The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit.”
- PressBleepingComputer
“Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.”
+1 more: BleepingComputer on Bluesky
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-44f5e7b0cb
Has OpenSSH confirmed it?
Yes. Confirmed as CVE-2026-123158.Source: Mastodon, Mastodon, oss-security, Mastodon, Mastodon, r/cybersecurity, Mastodon, SecurityWeek, BleepingComputer
What should OpenSSH users do?
Update OpenSSH to a patched release as soon as one is available from your distribution or vendor. Restrict SSH access to trusted networks or VPNs until patched. Review authentication logs for unexpected successful logins. Identify OpenSSH versions in use and apply the vendor patch as soon as it is available. Review authentication and system logs for unexpected logins or new persistence mechanisms. Rotate credentials on any host that may have been exposed.
Does it have a CVE?
Yes. It is tracked as CVE-2026-123158.Source: CVE-2026-123158